GeoIP World Map

If you’re tracing problems across a world-wide network, or just want to know where traffic and visitors are coming from, CloudShark’s new GeoIP maps will show you where in the world your packets are from.

The analysis tool gives you a map of the world shaded for the number of endpoints, packets, or bytes.

Changing what data is displayed on the map will update the table, and hovering over the graph or the table will highlight the corresponding entry. Clicking on a country will bring you right to the display filter for those packets. And, like everything else in CloudShark, can be accessed simply by URL.

Geolocation features are visible through the Endpoints analysis tool. If the network address is able to be resolved geographically, additional information like City, Country, and AS Number may also appear in the table along with Latitude and Longitude if available.

Private network addresses, including multicast, will not be resolved.

MaxMind GeoIP2 Databases

As of CloudShark 5.2, GeoIP databases are no longer bundled with CloudShark. To use geolocation features, you must download and install the MaxMind GeoIP2 databases yourself. MaxMind offers free (GeoLite2) and paid (GeoIP2) editions that translate IP addresses into City, Country, and ASN. The paid databases are updated more frequently and provide more granular data.

Installation

CloudShark requires the binary format of the GeoIP databases. Once you have these databases and have unzipped them you will need to copy them to a location on the CloudShark Appliance that the cloudshark user has permission to read. For example place the database files in /home/cloudshark/geoip_db/.

Next edit the file /usr/cloudshark/share/wireshark/maxmind_db_path and replace the contents with the following:

“/home/cloudshark/geoip_db/”

Finally, restart CloudShark for the updated GeoIP databases to take effect.